KR100955725B1 - Method and System for Preventing Memory Hacking - Google Patents

Abstract

According to an embodiment of the present invention, in which a method for various memory hacking or various bypass paths exist, a memory hacking blocking method according to an embodiment of the present invention, which may block hacking of a memory, may be used. Randomly selecting an address; And storing the program variable at the selected address.

Program, memory, hack, shuffle, variable

Description

Method and System for Preventing Memory Hacking

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and a system for preventing memory hacking, and more particularly, a hacking program for obtaining information of a program installed and operated in a digital processing device such as a computer for improper purposes, and being loaded in a memory of the digital processing device. A method and system for preventing hacking to memory when in operation.

Recently, with the development of digital processing devices such as computers, various programs installed and operating in such digital processing devices have been developed.

These programs are developed by developers and programmers with a lot of time and effort, and various copy protection devices and methods are used to prevent others from illegally copying or using such programs.

However, when the information constituting the program is found out due to the nature of the program, illegal copying or modification of the program becomes easy.

In particular, hacking is a method of finding out such information constituting a program by directly manipulating the memory, which is the area where the program's execution code and data are stored, by manipulating variables, constant values, or codes used in the program. Taking an unfair advantage is called memory hacking.

Recently, such memory hacking is made more intelligent by modifying the memory through a memory editor or by using a dedicated memory hacking tool (Cheat Engine).

Hereinafter, a conventional memory hacking method will be described with reference to FIGS. 1 and 2.

First, FIG. 1 schematically illustrates an operation principle of a memory hacking tool.

As shown in FIG. 1, the operation principle of the memory hacking tool searches an address where an actual value is stored through a conditional search for a change in a value increment.

Therefore, if such a value or a file is changed, a memory hack is performed by manipulating the retrieved value or file, that is, a variable, a constant value, or a code.

2 is a view schematically illustrating a principle of memory hacking blocking through a conventional memory access control.

As shown in FIG. 2, memory hacking is first stored in a memory hacking tool by accessing the in-game memory by penetrating a program process, for example, a game process, by a DLL injection method (Dynamic Linking Library Injection). Manipulate variables.

In addition, in the kernel, hacking is done by using a user-defined driver or by connecting a kernel and a process.

However, as shown in FIG. 2, since there are so many methods or paths for hacking a memory and there are many bypass paths using the same, it is possible to completely prevent memory hacking using only the memory hacking prevention method shown in FIG. 2. It is virtually impossible.

Therefore, if such a memory hack is not fundamentally blocked, there is a problem in that not only the illegal copying or use of the program but also the provision of the corresponding service when providing the service through the communication network using such a program.

The present invention has been made in view of the above-described problems, and it is a technical object of the present invention to provide a memory hacking blocking method and system that can block hacking of a memory even when various bypassing paths and various bypass paths exist.

Another object of the present invention is to provide a memory hacking blocking method and system for smoothly providing a corresponding service when providing a service through a communication network by using a program by preventing hacking of the memory.

Memory hacking blocking method according to an aspect of the present invention for achieving the above object comprises the steps of: randomly selecting a memory address to be stored in the program variable each time a predetermined program variable is used; And storing the program variable at the selected address.

The memory hacking blocking method may further include encoding the program variable using a predetermined encoding algorithm before the storing of the program variable, wherein in the program variable encoding step, the encoding is performed. The algorithm is characterized in that randomly selected from among a plurality of encoding algorithms.

Meanwhile, the plurality of encoding algorithms may be updated in predetermined periods.

The memory hacking blocking method may further include decoding the program variable using a decoding algorithm matching the encoding algorithm when the program variable is called; And providing the decoded program variable.

Memory hacking prevention method according to another aspect of the present invention for achieving the above object comprises the steps of maintaining a database in which a plurality of encoding algorithms and a plurality of decoding algorithms matching each encoding algorithm is matched and stored; Each time a predetermined program variable is used, randomly selecting a memory address in which the program variable is to be stored; Randomly selecting any one of a plurality of encoding algorithms from the database; Encoding the program variable using a selected encoding algorithm; And storing the encoded program variable at the selected address.

In one embodiment, each encoding and decoding algorithm is characterized in that it is defined in one template for all program variable types.

Memory hacking prevention system according to another aspect of the present invention for achieving the above object is a memory for storing a predetermined program variable; And an address allocator for randomly allocating a memory address where the program variable is to be stored each time the program variable is used.

As described above, according to the present invention, even when there are various methods for hacking memory or various bypass paths, the hacking of the memory can be effectively blocked.

In addition, according to the present invention, by providing a service through a communication network by using a program by preventing the hacking of the memory has the effect that can provide a smooth service.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, and the same or corresponding components will be denoted by the same reference numerals regardless of the reference numerals, and redundant description thereof will be omitted.

3 is a diagram illustrating a schematic configuration of a memory hacking blocking system according to an embodiment of the present invention.

As shown in FIG. 3, the memory hacking blocking system 100 according to an embodiment of the present invention may include a memory 110, an address allocator 120, an encoder 130, a decoder 140, and a shuffle engine ( 150, and database 160.

The memory 110 is an area in which data is stored. In particular, in the present invention, various program variables used to drive a predetermined program are stored. It is apparent that the memory 110 may store not only variables of a program but also other data for executing the program and various data necessary for controlling and driving a digital processing apparatus such as a computer on which a program is installed.

In general, when a variable is declared in a program, a value for the variable is fixed and maintained in an arbitrary area of the memory 110.

Hacking for acquiring program information for improper purposes is usually performed by finding a variable that is fixedly stored in an arbitrary area of the memory 110.

Therefore, in the present invention, whenever a certain program variable is used in a program, the address of the memory 110 in which the program variable is to be stored is dynamically changed to prevent such a problem.

To this end, the address allocator 120 dynamically changes the memory address where the program variable is to be stored whenever the program variable is used due to a call to a predetermined program variable.

In one embodiment, the address allocator 120 may change the memory address by requesting an operation system to allocate a new memory area in order to change the memory address where the program variable is stored.

In this case, immediately after the new memory area is allocated by the operating system, it is desirable to release the conventionally allocated memory to prevent waste of memory and prevent program errors. Changing the variable storage address by reallocating memory can be variously applied according to the policy of the operating system in use.

Specifically, whenever the program variable is used, the address allocator 120 requests the operating system to reallocate a memory area for the variable. The memory address by reallocation may be different from the conventionally allocated memory address. When the variable is stored in the reallocated memory area, the conventionally allocated memory is released.

As described above, it is difficult to search the memory address where the program variable is stored by dynamically changing the memory address where the program variable is stored.

Encoder 130 encodes the program variable using a predetermined encoding algorithm prior to storing the program variable in order to more completely prevent memory hacking. That is, in the present invention, the storage area of the program variable is dynamically changed and the program variable is encoded and stored.

In one embodiment, the encoding algorithm used by the encoder 130 is randomly selected by the shuffle engine 150 to be described later whenever the program variables are used and stored.

When the program variable is called, if the program variable is encoded, the decoder 140 decodes the program variable by using a decoding algorithm matching the encoding algorithm used for encoding the program variable.

As with the encoder 130, the decoding algorithm used by the decoder 140 is also selected and provided by the shuffle engine 150 described later.

The shuffle engine 150 randomly selects one of a plurality of encoding algorithms stored in the database 160 to the encoder 130 whenever a program variable is required to be stored, and when the program variable is called, the corresponding program variable. A decoding algorithm that matches the encoding algorithm used for encoding of the memory is selected and provided to the decoder 140.

In other words, the present invention not only dynamically changes the memory address where a program variable is stored, but also dynamically changes an encoding algorithm for encoding the program variable, thereby being able to fundamentally block memory hacking.

In one embodiment, the shuffle engine 150 blocks the hacking of memory by expanding the range of available encoding and decoding algorithms by adding various encoding algorithms and decoding algorithms matching the encoding algorithm to the database 160 at predetermined intervals. Can be further solidified.

Therefore, as in the conventional memory hacking method, it is not easy to find program information even in the case of a memory access through a bypass access, so that the hacking of the memory can be more effectively blocked.

An example in which the shuffle engine is implemented in a program form is illustrated in FIG. 4.

As shown, when an initial shuffle is generated for a variable of a program, particularly a function constituting the program, that is, a shuffle object for dynamically changing an address of a memory in which the variable is to be stored, And randomly select one of decoding algorithms (Type A, Type B, Type C) to provide the selected encoding algorithm to the encoder. In addition, when the corresponding program variable is called, the decoder provides a decoding algorithm matching the encoding algorithm used for encoding the corresponding program variable.

In one embodiment, when the shuffle engine is implemented in a program form, encoding and decoding algorithms are not defined separately for each type of program variable. Instead, various types of program variables in a template are applied by applying a template concept. By defining them together, the ease of application can be maximized.

That is, even the same encoding algorithm is not defined for each type of program variable, for example, for an integer type or a float type, but is defined together in one template for all program variable types.

Referring back to FIG. 3, the database 160 stores a plurality of encoding and decoding algorithms used for encoding and decoding program variables. As described above, the encoding and decoding algorithms stored in the database 160 may be added by the shuffle engine 150 at predetermined intervals.

Although the database 160 is described as a separate component from the shuffle engine 150 in the above-described embodiment, the database 160 may be integrated with the shuffle engine 150 in a modified embodiment. will be.

In addition, in the above-described embodiment, the address allocator 120 is described as a separate component from the shuffle engine 150, but in the modified embodiment, the address allocator 120 is provided to the shuffle engine 150. It may be a subcomponent included or the shuffle engine 150 may perform the function of the address allocator 120 at the same time.

Hereinafter, a memory hacking blocking method according to an embodiment of the present invention will be described with reference to the configuration of the above-described memory hacking blocking system.

5 is a flowchart illustrating a memory hacking blocking method according to an embodiment of the present invention. As shown in FIG. 5, first, whenever a variable of a corresponding program is used, randomly select a memory address in which the corresponding program variable is to be stored (operation 500), and then assign the selected memory address to the corresponding program variable (see step 500). Step 510).

Next, any one of a plurality of encoding algorithms is randomly selected (operation 520), and a corresponding program variable is encoded using the selected encoding algorithm (operation 530).

On the other hand, it is determined whether a new access request for the program variable stored in the memory occurs (step 540), and when a new access request for the program variable occurs, a decoding algorithm matching the encoding algorithm used for encoding the program variable In operation 550, the corresponding program variable is decoded using the selected decoding algorithm in operation 560. On the other hand, when the program variable is stored in the memory again, the above-described steps 500 to 530 are executed again.

In the memory hacking prevention method according to the above-described embodiment, since the memory address of the program variable is dynamically changed, the corresponding program variable does not exist in the fixed memory address, so important data does not exist in the fixed memory address. It should satisfy the characteristic of Memory Non-Fixation.

In addition, by randomly selecting any one of a plurality of encoding algorithms to encode a program variable, the variable stored in the memory has randomness, which satisfies the property of Data Randomness that the data value stored in the memory must have randomness. do.

In addition, as described above, in the implementation of the shuffle engine, it is possible to maximize the application of the program by defining variables of various types of programs together in one template for a specific encoding algorithm.

Therefore, according to the present invention, in order to prevent memory hacking by dynamically changing the encoding address for encoding the corresponding variable as well as the dynamic change of the memory address where the corresponding program variable is stored whenever an access request for the program variable occurs. The required requirements are met, thus making it difficult to find out information about program variables, which can easily block memory hacking.

Memory hacking blocking method according to the various embodiments described above may be implemented in the form of a program that can be performed using a variety of computer means, the program for performing the memory hacking blocking method is a hard disk, CD-ROM, DVD , A computer-readable recording medium such as a ROM, a RAM, or a flash memory.

Those skilled in the art to which the present invention pertains will understand that the present invention can be implemented in other specific forms without changing the technical spirit or essential features.

Therefore, it is to be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. do.

1 is a view schematically showing the principle of operation of a general memory hacking tool.

2 is a schematic diagram illustrating a memory hacking blocking principle through a conventional memory access control.

3 is a diagram illustrating a schematic configuration of a memory hacking blocking system according to an embodiment of the present invention.

4 is a diagram illustrating an example in which a shuffle engine is implemented in a program form according to an embodiment of the present invention.

5 is a flowchart illustrating a memory hacking blocking method according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

100: memory hack blocking system 110: memory

120: address assignment unit 130: encoder

140: decoder 150: shuffle engine

160: database

Claims (13)

Each time a predetermined program variable is used, randomly selecting a memory address in which the program variable is to be stored; And Storing the program variable at the selected address; Before the storing step of the program variable, Encoding the program variable using a predetermined encoding algorithm, In the program variable encoding step, And the encoding algorithm is randomly selected from among a plurality of encoding algorithms. delete delete The method of claim 1, And the plurality of encoding algorithms are updated at predetermined intervals. The method of claim 1, When the program variable is called, decoding the program variable using a decoding algorithm matching the encoding algorithm; And And providing the decoded program variable. Maintaining a database in which a plurality of encoding algorithms and a plurality of decoding algorithms matching the respective encoding algorithms are matched and stored; Each time a predetermined program variable is used, randomly selecting a memory address in which the program variable is to be stored; Randomly selecting any one of a plurality of encoding algorithms from the database; Encoding the program variable using a selected encoding algorithm; And Storing the encoded program variable at the selected address. The method of claim 6, When the program variable is called, decoding the program variable using a decoding algorithm matching the encoding algorithm used for encoding the program variable; And And providing the decoded program variable. The method of claim 6, Wherein each encoding and decoding algorithm is defined in one template for all program variable types. A computer-readable recording medium having recorded thereon a program for performing the method according to any one of claims 1 to 4. A memory in which predetermined program variables are stored; An address allocator for randomly allocating a memory address where the program variable is to be stored each time the program variable is used; An encoder for encoding the program variable each time the program variable is used; A decoder for decoding the encoded program variable when the program variable stored at the memory address is called; A database in which a plurality of encoding algorithms and a plurality of decoding algorithms matching the respective encoding algorithms are matched and stored; And Any one of a plurality of encoding algorithms from the database is randomly selected each time the program variable is used and provided to the encoder, and a decoding algorithm matching the selected encoding algorithm is provided to the decoder each time the program variable is called. Memory hack blocking system comprising a shuffle engine provided. delete delete The method of claim 10, And the shuffle engine adds the encoding algorithm and the decoding algorithm to the database at predetermined intervals.

Images